Data & infrastructure
-
French cyber authority flags Citrix vulnerabilities across three product lines
CERT-FR has warned of newly documented vulnerabilities affecting Citrix XenServer, Workspace for Windows and UniconOS, covering code execution, privilege escalation and other risks.
-
LiteLLM gateway flaws exposed administrators, server files and AI provider keys
Check Point Research has detailed two patched LiteLLM weaknesses that could permit administrative takeover, code execution or theft of provider API credentials through an enterprise AI gateway.
-
Windows 11 24H2 Home and Pro editions reach end of security updates
Microsoft’s published lifecycle schedule places Windows 11 24H2 Home and Pro at the end of servicing on 13 October 2026, while Enterprise and Education editions retain a later deadline.
-
SAP issues critical fixes for Cloud SDK, NetWeaver and S/4HANA
SAP has published 16 security notes and four GitHub advisories in its October update, including a maximum-severity Cloud SDK flaw and critical access-control weaknesses in enterprise applications.
-
Anthropic says new defences cut data extracted in AI model distillation attacks
Anthropic reports that its new anti-distillation methods reduced harvested model data by around 90–99% in early testing. The performance estimate is company-reported and subject to changing attacker behaviour.
-
TFG London cyber incident disrupts systems at Hobbs, Whistles and Phase Eight
The Foschini Group says its UK subsidiary identified a cyber incident on 11 October. Stores remain open, but IT systems are unavailable while investigators assess possible data exposure.
-
Researchers find more than 800 exposed UK refrigeration and building controllers
A UK threat intelligence study reports more than 800 publicly reachable refrigeration and building management controllers. The exposure finding follows attacks against French supermarkets but does not establish British compromises.
-
France suspends Vacaf holiday aid platform after beneficiary data incident
France’s national family benefits body has taken the Vacaf holiday aid platform offline after receiving a report of exposed beneficiary data. Regular family benefit payments are unaffected, the agency says.
-
GitLab fixes critical unauthenticated code execution flaw in CI/CD compiler
GitLab has issued emergency patches for CVE-2026-97229, a maximum-severity vulnerability in its regular expression compiler that could allow unauthenticated code execution on self-managed servers.
-
Ahold Delhaize takes network systems offline while investigating security issue
Dutch retailer Ahold Delhaize says it has isolated some systems in response to a network security incident. Stores remain open, but the company has not disclosed the cause or extent of any compromise.